Merged from DEVEL to main. Two TCP fixes and two NULL reference fixes.

CHANGELOG

@@ -1,10 +1,20 @@
 TODO
 
-  * TODO: Fix unaligned 16-bit access in checksum routine.
+  * TODO: The lwIP source code makes some invalid assumptions on processor
-  * TODO: Fix assumptions on storage sizes wherever we cast.
+    word-length, storage sizes and alignment. See the mailing lists for
+    problems with exoteric architectures showing these problems.
+    We still have to fix this neatly.
 
 HISTORY
 
+(STABLE-0_7_0)
+
+  ++ Bug fixes:
+
+  * Fixed TCP bug for SYN_SENT to ESTABLISHED state transition.
+  * Fixed TCP bug in dequeueing of FIN from out of order segment queue.
+  * Fixed two possible NULL references in rare cases.
+
 (STABLE-0_6_6)
 
   ++ Bug fixes:

src/core/ipv4/icmp.c

@@ -80,7 +80,6 @@ icmp_input(struct pbuf *p, struct netif *inp)
       return;
     }
     LWIP_DEBUGF(ICMP_DEBUG, ("icmp_input: ping\n"));
-    LWIP_DEBUGF(DEMO_DEBUG, ("Pong!\n"));
     if (p->tot_len < sizeof(struct icmp_echo_hdr)) {
       LWIP_DEBUGF(ICMP_DEBUG, ("icmp_input: bad ICMP echo received\n"));
       pbuf_free(p);

src/core/tcp.c

@@ -147,11 +147,6 @@ tcp_close(struct tcp_pcb *pcb)
     pcb = NULL;
     break;
   case SYN_RCVD:
-    err = tcp_send_ctrl(pcb, TCP_FIN);
-    if (err == ERR_OK) {
-      pcb->state = FIN_WAIT_1;
-    }
-    break;
   case ESTABLISHED:
     err = tcp_send_ctrl(pcb, TCP_FIN);
     if (err == ERR_OK) {
@@ -1082,7 +1077,6 @@ tcp_pcb_purge(struct tcp_pcb *pcb)
 
     LWIP_DEBUGF(TCP_DEBUG, ("tcp_pcb_purge\n"));
     
-#if TCP_DEBUG
     if (pcb->unsent != NULL) {    
       LWIP_DEBUGF(TCP_DEBUG, ("tcp_pcb_purge: not all data sent\n"));
     }
@@ -1093,18 +1087,13 @@ tcp_pcb_purge(struct tcp_pcb *pcb)
     if (pcb->ooseq != NULL) {    
       LWIP_DEBUGF(TCP_DEBUG, ("tcp_pcb_purge: data left on ->ooseq\n"));
     }
-#endif
+    
-#endif /* TCP_DEBUG */
-    tcp_segs_free(pcb->unsent);
-#if TCP_QUEUE_OOSEQ
     tcp_segs_free(pcb->ooseq);
+    pcb->ooseq = NULL;
 #endif /* TCP_QUEUE_OOSEQ */
+    tcp_segs_free(pcb->unsent);
     tcp_segs_free(pcb->unacked);
-    pcb->unacked = pcb->unsent =
+    pcb->unacked = pcb->unsent = NULL;
-#if TCP_QUEUE_OOSEQ
-      pcb->ooseq =
-#endif /* TCP_QUEUE_OOSEQ */
-      NULL;
   }
 }
 

src/core/tcp_in.c

@@ -421,7 +421,7 @@ tcp_listen_input(struct tcp_pcb_listen *pcb)
       &(iphdr->dest), &(iphdr->src),
       tcphdr->dest, tcphdr->src);
   } else if (flags & TCP_SYN) {
-    LWIP_DEBUGF(DEMO_DEBUG, ("TCP connection request %u -> %u.\n", tcphdr->src, tcphdr->dest));
+    LWIP_DEBUGF(TCP_DEBUG, ("TCP connection request %u -> %u.\n", tcphdr->src, tcphdr->dest));
     npcb = tcp_alloc(pcb->prio);
     /* If a new PCB could not be created (probably due to lack of memory),
        we don't do anything, but rely on the sender will retransmit the
@@ -540,8 +540,8 @@ tcp_process(struct tcp_pcb *pcb)
   case SYN_SENT:
     LWIP_DEBUGF(TCP_INPUT_DEBUG, ("SYN-SENT: ackno %lu pcb->snd_nxt %lu unacked %lu\n", ackno,
      pcb->snd_nxt, ntohl(pcb->unacked->tcphdr->seqno)));
-    if (flags & (TCP_ACK | TCP_SYN) &&
+    if ((flags & TCP_ACK) && (flags & TCP_SYN)
-       ackno == ntohl(pcb->unacked->tcphdr->seqno) + 1) {
+        && ackno == ntohl(pcb->unacked->tcphdr->seqno) + 1) {
       pcb->rcv_nxt = seqno + 1;
       pcb->lastack = ackno;
       pcb->snd_wnd = tcphdr->wnd;
@@ -569,7 +569,7 @@ tcp_process(struct tcp_pcb *pcb)
       if (TCP_SEQ_LT(pcb->lastack, ackno) &&
           TCP_SEQ_LEQ(ackno, pcb->snd_nxt)) {
         pcb->state = ESTABLISHED;
-        LWIP_DEBUGF(DEMO_DEBUG, ("TCP connection established %u -> %u.\n", inseg.tcphdr->src, inseg.tcphdr->dest));
+        LWIP_DEBUGF(TCP_DEBUG, ("TCP connection established %u -> %u.\n", inseg.tcphdr->src, inseg.tcphdr->dest));
 #if LWIP_CALLBACK_API
         LWIP_ASSERT("pcb->accept != NULL", pcb->accept != NULL);
 #endif
@@ -601,7 +601,7 @@ tcp_process(struct tcp_pcb *pcb)
     tcp_receive(pcb);
     if (flags & TCP_FIN) {
       if (flags & TCP_ACK && ackno == pcb->snd_nxt) {
-        LWIP_DEBUGF(DEMO_DEBUG,
+        LWIP_DEBUGF(TCP_DEBUG,
          ("TCP connection closed %d -> %d.\n", inseg.tcphdr->src, inseg.tcphdr->dest));
   tcp_ack_now(pcb);
   tcp_pcb_purge(pcb);
@@ -619,7 +619,7 @@ tcp_process(struct tcp_pcb *pcb)
   case FIN_WAIT_2:
     tcp_receive(pcb);
     if (flags & TCP_FIN) {
-      LWIP_DEBUGF(DEMO_DEBUG, ("TCP connection closed %u -> %u.\n", inseg.tcphdr->src, inseg.tcphdr->dest));
+      LWIP_DEBUGF(TCP_DEBUG, ("TCP connection closed %u -> %u.\n", inseg.tcphdr->src, inseg.tcphdr->dest));
       tcp_ack_now(pcb);
       tcp_pcb_purge(pcb);
       TCP_RMV(&tcp_active_pcbs, pcb);
@@ -630,7 +630,7 @@ tcp_process(struct tcp_pcb *pcb)
   case CLOSING:
     tcp_receive(pcb);
     if (flags & TCP_ACK && ackno == pcb->snd_nxt) {
-      LWIP_DEBUGF(DEMO_DEBUG, ("TCP connection closed %u -> %u.\n", inseg.tcphdr->src, inseg.tcphdr->dest));
+      LWIP_DEBUGF(TCP_DEBUG, ("TCP connection closed %u -> %u.\n", inseg.tcphdr->src, inseg.tcphdr->dest));
       tcp_ack_now(pcb);
       tcp_pcb_purge(pcb);
       TCP_RMV(&tcp_active_pcbs, pcb);
@@ -641,7 +641,7 @@ tcp_process(struct tcp_pcb *pcb)
   case LAST_ACK:
     tcp_receive(pcb);
     if (flags & TCP_ACK && ackno == pcb->snd_nxt) {
-      LWIP_DEBUGF(DEMO_DEBUG, ("TCP connection closed %u -> %u.\n", inseg.tcphdr->src, inseg.tcphdr->dest));
+      LWIP_DEBUGF(TCP_DEBUG, ("TCP connection closed %u -> %u.\n", inseg.tcphdr->src, inseg.tcphdr->dest));
       pcb->state = CLOSED;
       recv_flags = TF_CLOSED;
     }
@@ -1021,7 +1021,7 @@ tcp_receive(struct tcp_pcb *pcb)
       }
       cseg->p = NULL;
     }
-    if (flags & TCP_FIN) {
+    if (TCPH_FLAGS(cseg->tcphdr) & TCP_FIN) {
       LWIP_DEBUGF(TCP_INPUT_DEBUG, ("tcp_receive: dequeued FIN.\n"));
       recv_flags = TF_GOT_FIN;
     }

src/core/udp.c

@@ -772,9 +772,9 @@ udp_new(void) {
   if (pcb != NULL) {
     /* initialize PCB to all zeroes */
     memset(pcb, 0, sizeof(struct udp_pcb));
+    pcb->ttl = UDP_TTL;
   }
   
-  pcb->ttl = UDP_TTL;
   
   return pcb;
 }

src/include/lwip/opt.h

@@ -502,10 +502,6 @@ a lot of data that needs to be copied, this should be set high. */
 #define DBG_TYPES_ON                    0
 #endif
 
-#ifndef DEMO_DEBUG
-#define DEMO_DEBUG                      DBG_OFF
-#endif
-
 #ifndef ETHARP_DEBUG
 #define ETHARP_DEBUG                    DBG_OFF
 #endif